Phishing, BEC, and Wire Fraud: How Email Schemes Lead to Federal Prosecution

Phishing, business email compromise, and dark web fraud schemes are commonly charged as federal wire fraud under 18 U.S.C. § 1343.

Prosecutors do not have to prove hacking, malware, or computer intrusion. They have to prove an intentional scheme built on material deception, aimed at money or property, carried out using an interstate or foreign wire.

That makes wire fraud the government’s most flexible charging tool in email fraud cases, and each count carries up to 20 years in prison.

What follows explains how federal agents build these cases, why the person who clicked “send” is rarely the only target, and where the real defense openings sit.

How Do Phishing and BEC Schemes Turn Into Federal Wire Fraud Charges?

A phishing or BEC scheme becomes federal wire fraud when the government can prove an intentional scheme involving material deception, with money or property as an object, executed through an interstate or foreign wire.

The federal wire fraud statute, 18 U.S.C. § 1343, was written in 1952 for telephone and telegraph fraud.

The language reaches writings, signs, signals, pictures, and sounds sent by wire, radio, or television, which is broad enough to cover email, text messages, phone calls, and online transfers.

The government must still prove that an interstate or foreign wire was actually used, though routing records from email servers and payment networks often establish that circumstantially.

The statute carries a maximum of 20 years per count. That maximum climbs to 30 years and a $1,000,000 fine when the offense affects a financial institution or involves benefits tied to a presidentially declared disaster or emergency.

The financial institution trigger is narrower than it sounds, and it is worth arguing about. Courts applying the financial institution provision have rejected an effect that is too remote or indirect, and simply moving victim money through a bank has not been enough on its own.

The bank generally has to face something real, such as exposure to loss or civil liability, which means the 30-year range should not be treated as automatic in a BEC case.

What Does the Government Have to Prove Under 18 U.S.C. § 1343?

The Department of Justice lists four elements of wire fraud that a prosecutor must prove beyond a reasonable doubt:

• The defendant voluntarily and intentionally devised or participated in a scheme to defraud another out of money
• The defendant did so with the intent to defraud
• It was reasonably foreseeable that interstate wire communications would be used
• Interstate wire communications were in fact used

Notice what is missing from that list. There is no requirement that the victim actually lost money, no requirement that the defendant personally sent the email, and no requirement that any computer was accessed without permission.

The Supreme Court confirmed the loss point in Kousisis v. United States, decided in May 2025, holding that a defendant who induces a transaction through materially false pretenses can be convicted even without seeking to cause economic loss.

What the Court left in place matters just as much, because materiality remains an element and money or property must still be an object of the scheme.

The wire is not a technicality either, since each qualifying transmission is an element of each substantive count rather than a jurisdictional afterthought.

This is why a person who never wrote a single phishing email can still be convicted, if the government can show that person knowingly joined a plan that depended on those emails.

How Does a Business Email Compromise Scheme Actually Work?

Business email compromise works by impersonating someone the victim already trusts and asking that victim to send a payment to the wrong account.

The FBI identifies three core tactics in BEC schemes: email spoofing that uses a near-identical address, spearphishing messages that appear to come from a known contact, and malware that quietly reads a company’s billing conversations.

The malware piece matters more than people realize, because it lets a scheme operator time the fraudulent request to land exactly when a real invoice is due.

Invoice redirection is one version that North Texas businesses see often. A vendor’s email account gets compromised, and the next invoice that reaches the customer carries new banking details in the payment instructions.

The customer pays what looks like a routine bill, and the money lands in an account controlled by someone else entirely.

CEO impersonation is another common version. An email that appears to come from a company president or CFO tells a payroll or accounting employee to push through an urgent wire, usually with instructions to keep it quiet because of a pending deal.

The urgency and the secrecy are the point, because both are designed to stop the employee from picking up the phone to confirm.

Real estate closings are a frequent target in the Dallas and Fort Worth market. A buyer receives what looks like closing wire instructions from the title company, sends the down payment, and discovers days later that the title company never sent that email.

Those losses are large and fast, and the dollar amounts involved often put the case in federal hands.

The scale of the problem drives how aggressively these cases get charged. The FBI’s 2025 Internet Crime Report logged 24,768 BEC complaints with reported losses of more than $3 billion, alongside 191,561 phishing and spoofing complaints.

Total reported cybercrime losses passed $20.8 billion across more than one million complaints that year.

Does Vishing Count as Wire Fraud?

Yes, vishing is prosecuted as wire fraud, and the statute covers it just as clearly as email.

Vishing is voice phishing, meaning a phone call or automated recorded message that pretends to come from a bank, a government agency, or a company the victim deals with.

Because § 1343 reaches “sounds” transmitted by wire or radio communication, a recorded voice message asking for an account number fits the statute directly.

The same is true of smishing, which uses text messages to push a victim toward a fake phone line or website.

Federal courts have handled these cases for years.

In the Northern District of Georgia, three Romanian nationals were extradited to the United States and pleaded guilty to wire fraud conspiracy, computer fraud, and aggravated identity theft after running a vishing and smishing operation from overseas.

They compromised American servers, sent automated bank calls and texts, and collected roughly 42,793 financial account numbers, with an estimated loss above $21,000,000.

The indictment paired wire fraud conspiracy with computer fraud and identity theft counts, which is a common charging pattern in these cases.

That case shows why the vishing label matters less than people expect. Whether the deception arrives by email, text, recorded call, or live conversation, the government treats it the same way once money moves across a wire.

The charging decision turns on the scheme and the transmission, not the technology used to deliver the lie.

How Does Dark Web Activity Lead to Wire Fraud Charges?

Dark web activity leads to wire fraud charges when stolen credentials bought or sold on those marketplaces are then used to take money from real accounts.

Dark web markets function as supply chains for fraud. They sell stolen logins, compromised email access, phishing kits, spoofed domain services, and lists of corporate contacts sorted by role and company size.

A person who never writes a line of code can assemble a working BEC operation from parts purchased in an afternoon.

Buying stolen credentials can serve as evidence of intent, and it can also support separate charges such as access device fraud or identity theft.

In March 2026, a Michigan man was sentenced in the District of Minnesota to 60 months in prison for wire fraud and aggravated identity theft after buying 2,468 stolen login credentials from Genesis Market, a marketplace the FBI shut down in April 2023.

He also tried to sell victim data on a cybercriminal forum.

The wire fraud count carried the case, and the identity theft count added mandatory time on top of it.

Marketplace takedowns create a lasting evidence problem for anyone who used them. When the FBI seizes a market’s servers, it can recover purchase histories, wallet addresses, private messages, and login records, depending on what the operators stored.

Charges can follow long after the site disappears, built almost entirely from records the defendant assumed were private.

Why Do Prosecutors Charge Wire Fraud Instead of Computer Crimes?

Prosecutors often prefer wire fraud over the Computer Fraud and Abuse Act in email fraud cases because it does not require proving that anyone accessed a computer without authorization.

The choice is case-specific rather than automatic, and the comparison below is limited to the computer fraud provision most often considered alongside a BEC scheme.

The practical effect is that a defense built around “no one hacked anything” often misses the target.

Under 18 U.S.C. § 1349, anyone who conspires or attempts to commit wire fraud faces the same penalties as someone who completed it.

That provision lets prosecutors charge an entire network under one theory, though statutory maximums are not simply added together, because fraud counts are commonly grouped when the guideline range is calculated.

The Supreme Court’s 2021 decision in Van Buren v. United States narrowed the computer statute further.

The Court held that a person only exceeds authorized access when they obtain information from areas of a computer that are off limits to them, rejecting the government’s broader reading that misusing information you were allowed to see counts as a computer crime.

The wire fraud statute was untouched by that ruling, which is one reason defense counsel should expect § 1343 to anchor the indictment.

For someone facing an email fraud investigation, that means the defense has to engage with intent and participation, not just with the technical question of who accessed what.

What Charges Get Stacked on Top of Wire Fraud?

Wire fraud is often charged alongside other offenses, and the stacked counts can drive the sentence more than the fraud count does.

A typical federal indictment in a phishing or BEC case includes conspiracy, aggravated identity theft, and money laundering counts layered on top of the substantive wire fraud charges.

Each layer serves a purpose, and each one changes the negotiating position.

How Does Aggravated Identity Theft Increase the Sentence?

Aggravated identity theft adds a mandatory two years in prison that must run consecutively to the sentence on the underlying fraud.

Under 18 U.S.C. § 1028A, anyone who knowingly uses a means of identification of another person during and in relation to an enumerated felony receives a flat two-year term, and subsection (c)(5) expressly lists wire fraud as a qualifying predicate.

The judge cannot reduce that term or run it alongside the fraud sentence, though subsection (b)(4) does allow a court to run multiple § 1028A terms concurrently with each other.

The count is narrower than prosecutors once argued.

In Dubin v. United States, decided in June 2023, the Supreme Court held that the misuse of another person’s identification must be at the crux of what makes the underlying conduct criminal, not merely incidental to it.

Using a stolen login belonging to a real person to access an account can meet that standard, because the deception goes to who is acting.

Spoofing an executive’s display name does not automatically satisfy it, and that distinction is worth litigating whenever a § 1028A count is added to a BEC indictment.

Why Do Money Laundering Counts Follow the Fraud Counts?

Money laundering counts follow because fraud proceeds have to move, and transactions made with knowledge of their criminal source can be charged on top of the fraud.

Under 18 U.S.C. § 1956, conducting a financial transaction while knowing the funds are proceeds of unlawful activity, with a further purpose such as promoting that activity or concealing its source, carries up to 20 years in prison.

Moving money is not laundering by itself, because both the knowledge element and the required purpose have to be proved.

Subsection (h) makes conspiracy to launder punishable by the same 20-year maximum. This is where people who thought they were on the edge of a scheme end up in the middle of one.

Someone who receives a wire into a personal account, keeps a percentage, and forwards the rest is describing the classic money mule role.

The government charges those transfers as laundering transactions, and it does not matter that the person never sent a phishing email or knew the victim’s name.

What does matter is knowledge, because someone who genuinely did not know the funds were criminal proceeds lacks the mental state the statute requires.

In June 2025, five defendants in the Eastern District of Texas were sentenced for wire fraud conspiracy and money laundering conspiracy after a scheme that combined business email compromise with romance and investment fraud.

The group defrauded at least 100 victims of roughly $17 million and laundered the money through accounts in Africa and Asia.

Sentences ranged from 109 months to 480 months, showing how far apart outcomes can land for people charged in the same indictment.

The public record does not explain what produced that spread, and role, plea posture, and loss attribution all shape a federal sentence.

How Does International Cooperation Shape a Phishing or BEC Investigation?

International cooperation extends these investigations far past the United States, and being located abroad is not the shield that scheme operators often assume.

Federal agents work through mutual legal assistance treaties, INTERPOL notices, extradition requests, and direct liaison relationships with foreign police agencies.

Bank records, server logs, and phone data from other countries routinely appear in American indictments.

The Romanian vishing defendants described earlier were extradited to Atlanta, which shows that extradition is a live possibility where a treaty and cooperating authorities exist.

Coordinated global operations now sweep up large numbers of participants at once.

INTERPOL’s Operation First Light 2026, which ran from January 15 to April 30, 2026, involved 97 countries and produced 5,811 arrests, with $293 million in illicit assets intercepted and 142,000 victims identified.

Business email compromise was one of the primary scheme types targeted.

Operations on that scale generate referrals, and a domestic account holder in Dallas can surface in a case that started with an arrest on another continent.

Timing creates a real disadvantage for the defense. Foreign evidence can arrive late in the process, sometimes after an indictment is already returned, and it can be difficult to test the chain of custody or the methods used to collect it.

Challenging that evidence takes early motion practice and a working understanding of how the treaty process actually functions.

What Makes Phishing and BEC Cases Hard to Defend?

These cases are hard to defend because the government usually has the data before anyone knows an investigation exists, and because the defense fights on three fronts at once: attribution, cooperating co-defendants, and encrypted messages that have already been recovered.

Each front requires a different approach, and losing one can undermine the others.

How Does the Government Prove You Were the Person Behind the Keyboard?

The government proves identity through a pattern of digital traces rather than through a single piece of evidence.

Investigators assemble IP logs, device fingerprints, browser sessions, email header data, cryptocurrency wallet flows, cell site records, and account registration details, then look for overlap.

One matching data point proves little, but ten overlapping points create a picture that is difficult to explain away.

Attribution is often where the defense has the most room to work. Shared home networks, VPN exit nodes reused by thousands of people, spoofed sender addresses, and accounts opened with stolen identities all create genuine ambiguity about who was actually at the keyboard.

A defense that engages a qualified digital forensics examiner early can sometimes show that the government’s attribution rests on inference rather than proof.

The window for that work is narrow. Once a case reaches trial posture, the government has had months or years with the data, and building a competing forensic picture from scratch takes time the defense may not have.

Why Do Co-Defendants Cooperate So Quickly in These Cases?

Co-defendants often cooperate quickly because federal sentencing rewards useful information, and everyone in the indictment knows the supply is limited.

A government motion for substantial assistance can support a departure under §5K1.1 and is the usual route below a statutory minimum.

It is not the only path below the guideline range, because the guidelines are advisory and a court can vary downward for other reasons under 18 U.S.C. § 3553(a).

Even so, cooperation is the fastest lever available, and defendants who move early tend to have more to trade than those who wait.

Cooperating witnesses also present a specific credibility problem. A cooperator has a direct incentive to describe other people as more involved than they were, because the value of the cooperation rises with the significance of the information.

Cross-examination has to expose that incentive without appearing to attack a witness the jury may find sympathetic.

The timing lesson is blunt. By the time a target letter arrives, other participants may have been talking to agents for months, and the version of events already in the file may be one the defense has to dismantle rather than one it gets to build.

Do Encrypted Messages Protect You in a Federal Fraud Case?

Encrypted messaging apps provide far less protection than most people assume, because the government usually obtains the messages from a device rather than from the network.

End-to-end encryption protects data while it travels. It offers much less once investigators have a phone, a laptop, or a cloud backup, because extraction tools can often read chat histories stored on the device itself.

A co-defendant who hands over an unlocked phone delivers whatever conversations remain stored on it.

Deleted messages are sometimes recoverable, since NIST guidance notes that deleted data may be retrieved when it has not been overwritten, and cloud backups can hold content the user believed was gone.

Recovery is not guaranteed, because it depends on the platform, the device, disappearing message settings, retention practices, and the extraction method available.

Encrypted platforms also generate metadata showing who communicated with whom and when, which prosecutors use to build the structure of a conspiracy even without message content.

Deletion after learning of an investigation creates its own exposure. Wiping devices, closing accounts, or clearing chat histories once you know agents are looking can support charges under 18 U.S.C. § 1519 where the destruction is done with intent to impede a federal matter.

The guideline enhancement for obstruction likewise turns on willful conduct, so intent is what converts routine deletion into added exposure.

How Do Sentencing Enhancements Work in Phishing and BEC Cases?

Sentencing in these cases is driven by loss amount and by enhancements for sophisticated means, and those two factors usually matter more than the fraud conviction itself.

Federal sentences start with a guideline calculation under §2B1.1 of the United States Sentencing Guidelines.

The base offense level is low, and the loss table does the heavy lifting. Loss above $550,000 adds 14 levels, and loss above $1,500,000 adds 16 levels, which can move a first-time defendant from probation range into years of custody.

Intended loss can count, not just actual loss, so a scheme that attempted to steal far more than it took can be sentenced on the larger figure.

Relevant conduct rules can attribute a co-conspirator’s losses to a defendant who never touched that money, but only within limits.

Under §1B1.3 of the guidelines, another person’s acts count only if they were within the scope of the activity the defendant jointly undertook, in furtherance of it, and reasonably foreseeable.

Membership in a larger conspiracy is not enough on its own, which gives a lower-level participant a real argument against being sentenced on the whole scheme’s losses.

Fighting the loss calculation is often the single highest-value piece of defense work in a fraud case, because two levels on the table can mean a year of freedom.

The sophisticated means enhancement under §2B1.1(b)(10)(C) adds two levels when the offense involved especially complex or intricate conduct in executing or concealing the fraud, and when the defendant intentionally engaged in or caused that conduct.

Registering lookalike domains, layering funds through shell entities, routing money offshore, using cryptocurrency mixers, or operating through nominee accounts are the kinds of facts prosecutors point to.

The 2015 amendment to that guideline added the requirement that the defendant personally engaged in or caused the sophisticated conduct, which gives the defense a real argument for a peripheral participant who simply followed instructions.

Other enhancements stack on top. Levels can be added for the number of victims, for substantial financial hardship to victims, and for mass marketing.

The same subsection that covers sophisticated means also adds two levels when a defendant relocated a fraudulent scheme to another jurisdiction specifically to evade law enforcement or regulatory officials, or when a substantial part of the scheme was committed from outside the United States.

That foreign operation prong comes up often in BEC cases, since so many of these schemes run partly from overseas.

Each addition compounds, which is why guideline ranges in BEC cases often climb faster than defendants expect from the amount actually taken.

What Should You Do If Federal Agents Contact You About an Email Fraud Case?

Say nothing beyond confirming your name, ask for a lawyer, and preserve everything you have.

Federal agents who knock on a door in Dallas, Plano, or Fort Worth have usually been working the case for months and already have bank records, subscriber information, and often statements from other people.

An interview is not an opportunity to clear things up, and a knowingly and willfully made false statement that is material to a federal matter is its own felony under 18 U.S.C. § 1001, carrying up to five years in prison.

Do not delete anything. Do not wipe a phone, close an account, or clear a message history, because that conduct converts a defensible fraud case into a fraud case with an obstruction problem attached.

Preserve devices, statements, contracts, and correspondence exactly as they are, and hand them to counsel rather than sorting through them yourself.

Move early if you receive a target letter or a grand jury subpoena. The pre-indictment window is when the charging decision is still open, when the loss figure can still be shaped, and when counsel can present information to the prosecutor before positions harden.

How Should You Tell Your Lawyer What Happened?

Tell it backwards.

Start with where things stand today and work back toward the first contact, because a rehearsed account tends to leave out the facts that actually decide a case.

Most people organize their story around what they believe is important, and in a federal investigation that instinct is usually wrong.

Reversing the order forces recall instead of recitation, and the details that come loose are often the ones counsel needs most.

Michael Lowe describes the approach he uses on that first call:

“Let me say the important thing first, because this is easy to get wrong. I am not talking about clients lying to me. That is not what this is.

A person in the middle of a federal investigation is in a panic, and a person in a panic cannot know which facts matter. He may be certain that one thing is the crucial detail when the crucial detail is something he has not thought about in two years. Knowing which facts matter takes having handled a hundred of these. He has handled one, and he is living inside it.

Here is what happens. Before anybody calls a lawyer, he has already assembled in his head what he is going to say. Sometimes he has written it down. I call it the story. It is organized, it runs in order, and it is built around what he believes is important. And most people in this situation are not especially self-aware about their own conduct, which is frequently part of how they ended up here in the first place. They are not good historians of their own case.

So I have to stop him from telling it. And I have to do that without making him think I am a jerk who will not listen, because then he hangs up and calls somebody else. What I have settled on over twenty-eight years is this. When he starts, I politely ask him to stop. Then I ask him to put down whatever paper he is holding, start at the very end, at where things stand right now, and tell me the whole thing backwards.

It works because a rehearsed narrative only runs in one direction. You cannot recite a story in reverse. You have to actually remember it. What comes out is recall instead of recitation, and the facts he never planned to mention are the ones that come loose.

It also does something I did not design it to do. With the client who is himself a fraud victim, working backwards means he arrives at the first loss on his own, instead of me telling him he was scammed. He gets there himself, and that is the only way it ever sticks.

That last point matters more in email fraud cases than in most others.

A person who received a wire and passed it along often does not know yet whether he was recruited into a scheme or used by one, and that distinction is the whole case when knowledge is the contested element.

Working backwards from the last transfer to the first contact is usually what makes the answer visible, and it is also how the facts that support a lack of knowledge get found.”

Which federal court hears the case depends on the county, and the split surprises people. Under 28 U.S.C. § 124, Dallas County sits in the Dallas Division of the Northern District of Texas and Tarrant County sits in that district’s Fort Worth Division.

Collin and Denton counties are not in the Northern District at all, because both fall in the Sherman Division of the Eastern District of Texas, where court is held in Sherman and Plano.

A case built in Plano and a case built in Dallas move through different courthouses, different prosecutors, and different judges, so knowing the venue early shapes the whole defense.

Facing Federal Wire Fraud Charges From a Phishing or BEC Case?

Phishing, vishing, BEC, and dark web fraud schemes are commonly charged under the federal wire fraud statute because it is broad, it carries decades of exposure, and it does not require proof of hacking, which means the defense has to focus on intent, attribution, participation, and loss rather than on technology alone.

As a federal wire fraud defense attorney in Dallas, Michael can help you understand the charges, challenge the government’s evidence, and fight the loss calculations that drive your sentence.

Contact the Law Office of Michael Lowe today by calling 214-526-1900 for a free and confidential consultation.

Frequently Asked Questions

Is phishing a federal crime?

Phishing conduct can constitute federal wire fraud when every element of 18 U.S.C. § 1343 is met, including an intentional scheme, material deception, money or property as an object, and use of an interstate or foreign wire. A phishing message is not automatically wire fraud simply because it was sent electronically. The same conduct may also violate identity theft or access device statutes.

Does vishing constitute wire fraud?

Vishing can constitute wire fraud, because § 1343 reaches sounds transmitted by wire or radio in interstate or foreign commerce. The government must still prove an intentional scheme using material deception to obtain money or property, not merely that a deceptive call occurred. Federal prosecutors have charged vishing and smishing operations as wire fraud conspiracies, including against defendants extradited from abroad.

Can you be charged with BEC wire fraud if you only received the money?

Yes, if prosecutors can prove knowing participation, conspiracy, or the knowledge and purpose that money laundering requires. Unwitting receipt is not enough. Willful blindness can substitute for actual knowledge, but it demands proof that the person subjectively believed there was a high probability of wrongdoing and took deliberate steps to avoid confirming it, which is more than carelessness.

What is the average sentence for business email compromise?

There is no fixed average, because sentences depend on the guideline calculation rather than the charge itself. Loss amount drives the range, with losses above $1,500,000 adding 16 offense levels. Aggravated identity theft adds a mandatory consecutive two years. Sentences in recent federal BEC cases have ranged from a few years to several decades depending on role and loss.

Do encrypted apps protect you from a federal fraud investigation?

Not reliably. Encryption protects messages in transit, but investigators often obtain them from seized devices, cloud backups, or co-defendants who hand over their phones. Whether deleted content can be recovered depends on the platform, device, and retention settings. Deleting material with intent to impede a federal investigation can add obstruction exposure on top of the fraud case.

How long does the government have to file wire fraud charges?

Generally five years from each charged wire transmission, because every qualifying wire is a separate substantive offense under 18 U.S.C. § 3282. The period extends to ten years under § 3293 only when the offense actually affects a financial institution, which routing victim funds through a bank does not automatically establish. Conspiracy counts, tolling, and fugitive status follow separate rules.